GenAI is an indispensable part of the Guru service, and Guru keeps source content protected throughout the entire input/output transaction. Key security features include:

• Only relevant document matches are submitted to the third party LLM; thus ensuring the vast majority of content remains out of the AI workstream (Answers)
• Any content submitted to the third party LLM for processing is immediately removed after the output is returned (“zero day retention”)
• Guru does not use your content to train the LLM in any way; your content remains exclusively yours in a protected enclave
• Our third party AI partner undergoes recurring risk reviews and is bound by a Data Protection Agreement

The program is run by a dedicated infosec leader who works in tandem with executive leadership and subject matter experts to codify procedures and ensure execution.

Guru hires an independent audit firm to conduct an annual SOC 2, Type II audit, which includes not only the Common Criteria, but the Confidentiality and Privacy trust services criteria too.

Yes. We look at changes in the product line, the regulatory environment and the cyber threat. We assign risk scores and ensure executive leadership is routinely engaged in risk mitigation. These steps are verified in the annual SOC 2 audit.

• Guru offers multiple features to synchronize, process, store and make sense of your knowledge sources; inherent to all of these features is your ability to control which knowledge is shared
• Guru will only process what it needs to deliver on its service, and will consequently minimize collection of content and restrict retentions time to the greatest extent possible
• Your content is stored and managed in a highly secure AWS database, separated and protected from other client content by a unique team ID
• Any use of integrators is controlled through highly secure, encrypted API connections

We have a control framework based on the Center for Internet Security Controls, covering a wide compliance spectrum and ensuring we’re focused on the right things. We have nine separate policies that govern the following:

• Security and Privacy Roles
• Risk Management
• Asset Management and Protection
• Data Classification/Handling/Transmission
• Data Recovery and Business Continuity
• User Access Management
• People and Training
• Product Development and Change Management
• Supplier Relationships

By default, Guru staff do not have access to client data. This is reserved for back end administrators with a demonstrated need. These members are approved by the CTO in writing and accesses are reviewed three times annually.

Guru takes your medical privacy and security needs seriously, and while we are prepared to enter into a Business Associate Agreement for HIPAA compliance, we would first ask you to consider the likelihood that the Guru platform will ever consume, process, or store electronic protected health information. If you believe there's a reasonable chance that such personal data will find its way into the system, we are willing to provide a boilerplate BAA as Guru's signed assurance we will abide by the applicable HHS mandates for safeguarding your data.

Any vendor with the potential to access sensitive client data is required to provide an external audit or, at a minimum, submit to a risk interview and demonstrate best security practices. These artifacts are refreshed annually to ensure no lapse in oversight. Moreover, each vendor is required to sign a Data Processing Agreement and contractually commit to data security practices.

Our public facing network is scanned monthly for certificate currency, open ports and protocols and security headers. Our application containers are scanned through AWS prior to deployment to discover and address vulnerabilities.

Yes. The application is routinely pen tested by an outside agency no less than twice per year to reveal common OWASP vulnerabilities. An executive summary is available upon request.

We copy our database daily and save it to a disaster recovery site in an entirely separate region. We run a daily integrity check on that backup to make sure it’s usable if needed. The recovery point objective is 1 hour, with a recovery time objective of 24 hours.

Guru maintains a comprehensive incident classification and response procedure, rehearsing potential incidents twice annually through a formal tabletop exercise. Participants capture lessons learned and constantly strive to make the program better. Though highly unlikely, any data breach would be communicated to a client’s Guru administrator within 24 hours of confirmation.

Security is baked into the coding process, and a number of checks are performed to validate new code prior to deployment. Also, Guru’s developers undergo specialized security training to address common vulnerabilities such as Cross Site Scripting and SQL injection.

Guru fully respects both established and emerging privacy regulations and has created the necessary processes to support the rights of data subjects. Guru offers a Data Protection Agreement and contractually agrees to support any and all emerging privacy regulations as they apply to the service. Third parties are also required to document their security commitments consistent with laws and regulations.

In addition to AWS, Guru uses some third parties to perform certain components of its operations. Only vendors who have successfully demonstrated sufficient security capabilities and commitments are authorized to support the Guru system.